RFC 9989 — DMARC
Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
RFC 9989 is the DMARC specification. It obsoletes RFC 7489, the informational document the protocol ran on for a decade, and puts DMARC on the IETF standards track for the first time.
If you have ever seen DMARC described as “not really a standard” — that was accurate, and it no longer is.
What this document covers, and what it does not
RFC 7489 was replaced by three documents. This one is the protocol; the two reporting formats moved out, so each can be revised without re-opening the others:
| Document | Covers |
|---|---|
| RFC 9989 (this one) | Policy, alignment, record syntax, policy discovery |
| RFC 9990 | Aggregate reports — the XML your rua= address receives |
| RFC 9991 | Failure reports — the per-message detail ruf= requests |
It also obsoletes RFC 9091, the experimental Public Suffix Domain
extension, folding that work in as the psd tag.
The split matters when citing something. A question about report structure is answered by RFC 9990, not by this document — a distinction almost all existing material predates.
The tag registry, as it now stands
| Tag | Status | |
|---|---|---|
v p sp np adkim aspf rua ruf fo psd t | active | np and t are new in RFC 9989 |
pct | historic | Replaced by t |
rf | historic | Failure report format |
ri | historic | Aggregate report interval |
Note also that p is now RECOMMENDED rather than required: a syntactically
valid record without it is treated as p=none.
What changed, and what to do about it
That is a longer question than a reference page should answer, and there is a
guide for it. What changed in the new DMARC standard
covers each removed tag, the t replacement for pct, the DNS tree walk that
replaced Organizational Domain lookup, and the part with live consequences — how
to find a forgotten pct=25 still throttling your enforcement.
The short version for anyone auditing a record right now: if it does not use
pct, rf or ri, it is already an RFC 9989 record. It still lives at
_dmarc.yourdomain.com, still starts v=DMARC1, and DMARC still requires
SPF or DKIM to pass and
align with the From: domain.
Read it: rfc-editor.org/rfc/rfc9989